Lesson 1: Monitoring Systems CHAPTER 13 683 11. Use the same technique to add the C: instance of the PhysicalDisk\Avg. Disk Sec/Read counter. This counter measures the average time in seconds to read data from the disk. If the value is larger than 25 milliseconds (ms), the disk system is experiencing latency (delay) when reading from the disk. In this case, consider installing a faster disk system. 12. Use the same technique to add the C: instance of the PhysicalDisk\Avg. Disk Sec/Write counter. This counter measures the average time in seconds to write data to the disk. If the value is larger than 25 ms, the disk system is experiencing latency (delay) when writing to the disk. In this case, consider installing a faster disk system. More Info PHYSICALDISK\% DISK TIME COUNTER Because the value in the PhysicalDisk\% Disk Time counter can exceed 100 percent, many administrators prefer to use PhysicalDisk\% Idle Time, PhysicalDisk\Avg. Disk Sec/Read, and PhysicalDisk\Avg. Disk Sec/Write counters to obtain a more accurate indication of hard disk usage. For more information about the PhysicalDisk\% Disk Time counter, see http://support.microsoft.com/kb/310067. 13. Use the same technique to add the C: instance of the PhysicalDisk\Avg. Disk Queue Length counter. This counter indicates how many I/O operations are waiting for the hard drive to become available. If the value of this counter is larger than twice the number of spindles in a disk array the physical disk itself might be the bottleneck. 14. Use the same technique to add the Memory\Cache Bytes counter. This counter indicates the amount of memory being used for the file system cache. There might be a disk bottleneck if this value is greater than 300 MB. 15. Check that the Add Counters dialog box shows the same counters and instances as Figure 13-25. Click OK. note COUNTER INCLUDED BY DEFAULT The Processor\%Processor Time counter is included by default and you do not need to add it. It does not appear in the list in Figure 13-25, but you can see it in the line graph, histogram, and report views shown in Exercise 2. 16. Do not close Performance Monitor. Go directly to Exercise 2. exercise 2 Set Performance Monitor Properties and Monitor Disk Performance In this exercise, you set the sample interval and duration, read data from, and write data to the disk volume you are monitoring. You view the results in line, histogram, and report formats. Perform this exercise immediately after Exercise 1. 1. In the Performance Monitor Action pane, click More Actions and then click Properties. 2. On the General tab of the Performance Monitor Properties dialog box, in the Graph Elements section, change the Sample Every value to 5 and the Duration value to 300. Click OK. 6 8 4 CHAPTER 13 Monitoring and Performance FIGURE 13-25 Counters and instances added 3. Copy a file or folder (about 100 MB in size) from your C: drive to your attached storage device. 4. Copy a file or folder (about 100 MB in size) from your attached storage device to your C: drive. 5. View the line graph in Performance Monitor, as shown in Figure 13-26. This might not easily provide the information you are looking for. FIGURE 13-26 Performance Monitor line graph view Lesson 1: Monitoring Systems CHAPTER 13 685 6. In the Change Graph drop-down list, select Histogram Bar. View the histogram in Performance Monitor, as shown in Figure 13-27. FIGURE 13-27 Performance Monitor histogram view 7. In the Change Graph drop-down list, select Report. View the Report in Performance Monitor, as shown in Figure 13-28. FIGURE 13-28 Performance Monitor report view 6 8 6 CHAPTER 13 Monitoring and Performance 8. Analyze the counter values in light of the information given about each counter in Exercise 1. The results shown in the screen shots indicate that adequate free space remains on the C: volume and no problem occurred when copying a fairly large file or folder. Cache memory usage was significant, but this is normal and acceptable in this operation. The results you obtain are likely to be different. note FILE CACHING To obtain meaningful results, Exercise 2 asked you to obtain line, histogram, and report views for the same copying operations. Had you been asked to repeat the copy operations to obtain the histogram and report views, the results would have been different. This is because Windows 7 would have cached the file or folder after the first copy and the subsequent results would have reflected only the impact of writing the file to disk and retrieving it from RAM. Using the tools is relatively straightforward; interpreting the results sometimes is not. Lesson Summary n You can use Performance Monitor to view performance data in real time or performance counter values captured in DCSs. A system diagnostics report gives you details about the status of hardware resources, system response times, and processes on the local computer, along with system information and configuration data. n Reliability Monitor tracks a computer’s stability. It can also tell you when events that could affect stability (such as the installation of a software application) occurred and whether any restarts were required after these events. Action Center monitors your computer and reports problems with security, maintenance, and related settings. The Windows Experience Index indicates the suitability of your current computer hardware for running resource-intensive applications. n Task Manager gives you a snapshot of resource usage and lets you manage applications, service, and protocols. Resource Monitor allows you to view information about hardware and software resource use in real time. Process Explorer performs the same functions as Task Manager but gives you additional controls and more detailed system information. n Event Viewer lets you access and filter event logs and create custom views. You can attach tasks to events and configure event forwarding and event subscriptions so that a central computer can store events generated on one or more source computers. Lesson Review You can use the following questions to test your knowledge of the information in Lesson 1, “Monitoring Systems.” The questions are also available on the companion DVD if you prefer to review them in electronic form. Lesson 1: Monitoring Systems CHAPTER 13 687 note ANSWERS Answers to these questions and explanations of why each answer choice is correct or incorrect are located in the “Answers” section at the end of the book. 1. You have upgraded the hardware on a computer so that it can run an application that requires a large amount of processor resource. You use the Windows Experience Index tool to generate a new base score. The subscores for each feature are as follows: n Processor 5.1 n Physical Memory (RAM) 3.3 n Graphics 3.6 n Gaming Graphics 2.3 n Primary Hard Disk 5.3 Based on these figures, what is the Windows Experience Index base score? a. 2.3 B. 3.9 c. 5.1 D. 4.4 2. A client running Windows 7 is experiencing intermittent performance problems. You suspect the problems might be caused by an application that you recently installed but you have forgotten exactly when you did this. Which tool or feature would you use to determine when the application was installed? a. Reliability Monitor B. Action Center c. DCSs D. Performance Monitor 3. Which of the following types of information are stored in Reliability Monitor? (Choose all that apply; each correct answer presents part of a complete solution.) a. An application failed and needs to be restarted. B. A Windows error occurred and the system was rebooted. c. An application was uninstalled. D. A service was stopped. e. A device driver failed. 4. You are configuring a client running Windows 7 named Canberra to retrieve events from a computer running Windows 7 named Aberdeen. Both computers are on the same workgroup. Which of the following commands would you run on the collector computer to configure the Event Collector service? a. wecutil qc B. winrm qc 6 8 8 CHAPTER 13 Monitoring and Performance c. winrm qc -q D. %SYSTEMROOT%\System32\gpedit.msc 5. You want to use Performance Monitor to display performance data captured in a DCS. You open the tool and access the Performance Monitor Properties dialog box. On which tab can you choose whether to display current activity in real time or log files that you have saved using a DCS? a. General B. Source c. Data D. Graph e. Appearance Lesson 2: Configuring Performance Settings CHAPTER 13 689 Lesson 2: Configuring Performance Settings This lesson looks at configurations that can affect the performance of your computer and the tools that Windows 7 provides to display and reconfigure performance settings and resolve performance issues. If you do not like the tools provided, you can use Windows Management Instrumentation (WMI) scripts to write your own. Many factors affect performance, such as the appearance of your screen or your browser window, the services and processes that are running on your computer, and the priorities and processor affinity that you assign to various processes. Performance is affected by your cache and page file settings, by the services and applications that start automatically or run even when not required, and by what processes are running and the amount of resources each consumes. After this lesson you will be able to: n Use a variety of Windows tools to inspect and configure settings that affect Windows 7 performance. n Write WMI scripts that return system information and use the WMI tools. n Troubleshoot performance issues. Estimated lesson time: 45 minutes Obtaining System Information Using WMI WMI lets you access system management information and is designed to work across networks. It provides a consistent model of the managed environment and a WMI class for each manageable resource. A WMI class is a description of the properties of a managed resource and the actions that WMI can perform to manage that resource. A managed resource is any object (computer hardware, computer software, service, or user account) that can be managed by using WMI. To use WMI, you write scripts that use the WMI scripting library. This library lets you work with WMI classes that correspond to managed resources. You can use this approach to manage resources such as disk drives, event logs, and installed software. You can use Windows Script Host (WSH), Microsoft Visual Basic Scripting Edition (VBScript), Microsoft JScript, or scripting languages such as ActivePerl to write WMI scripts that automate the management of aspects of your network. Typically, Windows Imaging (WIM) files have .vbs extensions. You can write scripts to manage event logs, file systems, printers, processes, registry settings, scheduled tasks, security, services, shared folders, and so on. You can create WMI-based scripts to manage network services, such as the Domain Name System (DNS), and to manage client-side network settings, such as whether a computer is configured with static 6 9 0 CHAPTER 13 Monitoring and Performance Internet Protocol version 4 (IPv4) address settings or whether it obtains these settings from a Dynamic Host Configuration Protocol (DHCP) server. WMI scripts can monitor and respond to entries in an event log, modifications to the file system or the registry, and other real-time operating system changes. A WMI script works with WMI classes, which are representations of physical features or services on a computer. Each class can contain one or more objects or instances and the objects have attributes. You can display the value of each attribute or pass this on to another routine for analysis. Typically, you type WIM scripts using a text editor such as Microsoft Notepad and save them as .vbs files in a directory (for example, C:\WIM_Scripts) that you have created for this purpose. Be wary of using word processing software such as Microsoft Office Word for this process. Word processing software often uses different styles of quotation marks for different fonts (to cite one example), and this can cause syntax errors. You can run WIM scripts from an elevated command prompt by using the Cscript utility, and you can create batch files that run scripts at scheduled intervals or when triggered by an event. For example, the following WIM script accesses instances of the Win32_Battery class (there is only one) and prints out the value of the EstimatedChargeRemaining attribute. The code looks more complex than it actually is. You can substitute other WIM classes and find the values of their attributes by substituting the class and the attributes in this routine. strComputer = "." Set objSWbemServices = GetObject("winmgmts:\\" & strComputer) Set colSWbemObjectSet = objSWbemServices.InstancesOf("Win32_Battery") For Each objSWbemObject In colSWbemObjectSet Wscript.Echo "Remaining Charge: " & objSWbemObject.EstimatedChargeRemaining & " percent." Next Figure 13-29 shows the output from this script file, saved as Battery.vbs in the C:\WMI_Scripts folder. Note that if you run this script on a desktop computer, it should complete without error, but it does not give an output. FIGURE 13-29 Estimated battery charge remaining read by a WMI script Lesson 2: Configuring Performance Settings CHAPTER 13 691 You can substitute other WIM classes and find the values of their attributes by substituting the class and the attributes in the previous script. For example, FreePhysicalMemory is an attribute of objects in the Win32_OperatingSystem class (typically, there would be only one object in this class). The following WMI script outputs the free physical memory on a computer in kilobytes: strComputer = "." Set objSWbemServices = GetObject("winmgmts:\\" & strComputer) Set colSWbemObjectSet = objSWbemServices.InstancesOf ("Win32_OperatingSystem") For Each objSWbemObject In colSWbemObjectSet Wscript.Echo "Free physical memory: " & objSWbemObject.FreePhysicalMemory & " KB." Next Figure 13-30 shows the output from this script file, saved as Memory.vbs in the C:\WMI_Scripts folder. FIGURE 13-30 Free physical memory read by a WMI script More Info LIST OF WMI CLASSES You can obtain a list of WMI classes and their attributes at http://msdn.microsoft.com/ en-us/library/aa394554(VS.85).aspx. For a complete WMI reference, see http://msdn.microsoft .com/en-us/library/aa394572(VS.85).aspx. WarnIng WMI CLASSES If you use a WMI class, ensure that Windows 7 supports it. For example, the class Win32_LogicalMemoryConfiguration is deprecated and not supported. If you specify this class and run your script on a computer running Windows 7, this generates a 0x80041010 error. 6 9 2 CHAPTER 13 Monitoring and Performance You can write scripts that manage WMI classes that contain a number of objects. For example, the Win32_Services class contains all the services that run on a computer. The following script lists all these services: strComputer = "." Set objSWbemServices = GetObject("winmgmts:\\" & strComputer) Set colSWbemObjectSet = objSWbemServices.InstancesOf ("Win32_Service") For Each objSWbemObject In colSWbemObjectSet Wscript.Echo "Display Name: " & objSWbemObject.DisplayName & vbCrLf Next You can expand the previous script to determine the state (started or stopped) and the start mode for each service as follows: strComputer = "." Set objSWbemServices = GetObject("winmgmts:\\" & strComputer) Set colSWbemObjectSet = objSWbemServices.InstancesOf ("Win32_Service") For Each objSWbemObject In colSWbemObjectSet Wscript.Echo "Display Name: " & objSWbemObject.DisplayName & vbCrLf & " State: " & objSWbemObject.State & vbCrLf & " Start Mode: " & objSWbemObject.StartMode Next Figure 13-31 shows some of the output from the preceding script. FIGURE 13-31 Determining the state and start mode of each service You use WMI to administer managed resources. These include the computer system, Active Directory Domain Services (AD DS), disks, peripheral devices, event logs, files, folders, file systems, networking features, operating system subsystems, performance counters, printers, processes, registry settings, security, services, shared folders, users and groups, Windows Installer, device drivers, Simple Network Management Protocol (SNMP) management information base (MIB) data, and so on. . drop-down list, select Histogram Bar. View the histogram in Performance Monitor, as shown in Figure 1 3- 27. FIGURE 1 3- 27 Performance Monitor histogram view 7. In the Change Graph drop-down. en-us/library/aa394554(VS.85).aspx. For a complete WMI reference, see http://msdn.microsoft .com/en-us/library/aa394 572 (VS.85).aspx. WarnIng WMI CLASSES If you use a WMI class, ensure that Windows. device driver failed. 4. You are configuring a client running Windows 7 named Canberra to retrieve events from a computer running Windows 7 named Aberdeen. Both computers are on the same workgroup.